sa6anw/hedgedoc-hedgeagent
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

refactor: wildcard and strict host link whitelisting

Browse Source 
The previously contributed config option for whitelisting domains
treated all entries like wildcard entries and matched subdomains
too. Since some users don't want this behaviour, this changes the
config option to differentiate between wildcard entries like
"*.example.com" and strict host entries like "example.com".

Since this config option was not released yet, it is safe to
change it without breaking user setups.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This commit is contained in:
Erik Michelson
2026-07-05 00:35:16 +02:00
committed by Philip Molares
parent 0ebf0dbc6b
commit c77d64ad6e
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
public/js/extra.js
View File

@@ -612,11 +612,14 @@ export function rewriteExternalLinks (view) {
if (!['http:', 'https:'].includes(parsed.protocol) || parsed.origin === window.location.origin) {
return
}
// skip rewriting for whitelisted domains (exact match or subdomain, case-insensitive)
// skip rewriting for whitelisted domains while differentiating between wildcard entries and plain host entries
const hostname = parsed.hostname.toLowerCase()
if (whitelist.some(domain => {
const lowercaseDomain = domain.toLowerCase()
return hostname === lowercaseDomain || hostname.endsWith('.' + lowercaseDomain)
if (lowercaseDomain.startsWith('*.')) {
return hostname.endsWith('.' + lowercaseDomain.slice(2))
}
return hostname === lowercaseDomain
})) {
return
}